The price, and what it buys.
The Sentinel Security Risk Analysis is a bounded engagement with a published price: $2,895. It ends with two artifacts — a written, practice-specific analysis and a Remediation Register that tracks every finding to closure with an owner and a date. No membership is required, there is no recurring charge, and when the engagement ends there is no ongoing obligation on either side.
It is a conducted analysis, not a generated document. We map where your electronic patient information actually lives, assess the threats and safeguards specific to your practice, rate likelihood and impact with the reasoning recorded, and put every finding somewhere it can be worked — because enforcement attention has moved past whether an analysis exists to what was done about what it found.
Why most prices in this market are hidden.
Most compliance vendors quote a Security Risk Analysis only after a sales conversation, and prices vary widely with practice size, location count, and whether remediation tracking is included at all — or sold separately. None of that is wrong. But a practice manager comparing options deserves a number they can see before they spend an hour on the phone. Publishing the price is part of the same philosophy as the analysis itself: things you can verify beat things you’re asked to believe.
What can change the number.
Honestly: very little. Multi-location groups get scoped before we begin so the number is known up front. And if the analysis finds little risk, the report says so — we do not manufacture findings to justify the fee or to sell a membership afterward.
Common questions about the cost.
Is a Security Risk Analysis legally required?
Yes. 45 CFR 164.308(a)(1)(ii)(A) requires every practice that handles electronic patient information to conduct and document an accurate, thorough risk analysis. The rule names no frequency — an annual review is a widely used operating standard, not a statutory deadline — but the analysis itself is required, and it is among the most frequently cited deficiencies in federal enforcement.
Does the price change with practice size?
For an independent practice, no — $2,895 is the published flat price for the standalone engagement. Multi-location groups are scoped honestly before we begin, so you know the number before any work starts.
What do we actually receive for $2,895?
A conducted analysis — not a questionnaire — covering where your patient data lives, the threats specific to your practice, your current safeguards, and a risk determination with the reasoning recorded. It ends with a written analysis and a Remediation Register: every finding with an owner, a target date, and a place to record closure evidence.
Is the Security Risk Analysis included in a Sentinel membership?
Yes — it is included at every membership tier, never an add-on. The $2,895 standalone engagement exists for practices that want the analysis without a membership. There is no obligation on either side when it ends.
A generally useful note for owners: professional compliance services are typically an ordinary business expense for the practice — your CPA can confirm how that applies to you.
The next step.
Read the full description of the engagement, look at a complete sample analysis built from fictional practice data, or start with the free Readiness Proof Test. Practices anywhere in the U.S. can engage remotely — see how remote onboarding works.